OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http

Summary

@opentelemetry/instrumentation-http redacts sensitive URL query parameters on outgoing (client) spans but not on incoming (server) spans. The server-span path writes the raw query string verbatim into the url.query attribute, so credentials embedded in inbound request URLs — AWS presigned-URL signatures, Azure SAS tokens (sig), GCS signed-URL signatures — are exported in plaintext to the configured tracing backend.

Configuring the redactedQueryParams option does not change this, as this applies only to outgoing (client) spans.

Impact

Information disclosure / credential leakage (CWE-200; CWE-532, insertion of sensitive information into telemetry data).

Who is impacted: any Node.js service instrumented with @opentelemetry/instrumentation-http — directly or transitively via @opentelemetry/auto-instrumentations-node — that receives inbound requests carrying credentials in the query string. Common cases: services fronting presigned S3/GCS downloads, Azure SAS-token URLs, and signature-authenticated webhooks.

Consequence: clients' still-valid credentials are written into server spans and stored by the tracing backend, readable by anyone with span-read access — observability vendor infrastructure, dashboard users, and internal audiences far broader than the credential's intended scope. Presigned-URL signatures typically remain valid for minutes to days after capture, so this is not merely historical exposure.

Severity: Moderate. Exploitation requires read access to the telemetry backend, and inbound URLs must actually carry signed credentials. However, the gap is a documented mitigation that silently fails to apply, which defeats the mitigation operators would reach for.

Patches

This vulnerability has been patched in @opentelemetry/instrumentation-http version 0.222.0. Known sensitive query string values (as defined by Semantic Conventions) are redacted by default from span data for incoming spans. The redactedQueryParamsServer configuration option was added for customization.